diff --git a/docs/updating-keycloak.md b/docs/updating-keycloak.md
new file mode 100644
index 0000000..8940782
--- /dev/null
+++ b/docs/updating-keycloak.md
@@ -0,0 +1,17 @@
+# Updating Keycloak
+
+If keycloak needs to be updated for harbor to work, you can't really pull the image
+from Harbor, so we directly import the image into the cluster.
+See the steps I followed below.
+
+```
+podman build -f images/Dockerfile -t harbor.internal.jpace121.net/k8s/jpace-keycloak:26.8.0 .
+podman save harbor.internal.jpace121.net/k8s/jpace-keycloak:26.8.0 -o keycloak.tar
+scp keycloak.tar jimmy@192.168.1.112:.
+ssh jimmy@192.168.1.112
+sudo k3s ctr images import keycloak.tar
+sudo k3s ctr images ls
+exit
+kubectl apply -f manifests/deployment.yaml
+kubectl rollout restart deployment keycloak-deployment -n keycloak
+```
diff --git a/infra-cluster/keycloak/images/Dockerfile b/infra-cluster/keycloak/images/Dockerfile
index 70ecd80..312ecf1 100644
--- a/infra-cluster/keycloak/images/Dockerfile
+++ b/infra-cluster/keycloak/images/Dockerfile
@@ -1,4 +1,4 @@
-FROM quay.io/keycloak/keycloak:23.0
+FROM quay.io/keycloak/keycloak:26.8
 WORKDIR /opt/keycloak
 RUN ./bin/kc.sh build \
-    --spi-x509cert-lookup-provider=nginx
\ No newline at end of file
+    --db postgres
\ No newline at end of file
diff --git a/infra-cluster/keycloak/manifests/deployment.yaml b/infra-cluster/keycloak/manifests/deployment.yaml
index 7c98c02..c4fa158 100644
--- a/infra-cluster/keycloak/manifests/deployment.yaml
+++ b/infra-cluster/keycloak/manifests/deployment.yaml
@@ -37,7 +37,7 @@ spec:
             exec:
               command: ["/usr/local/bin/pg_ctl stop -D /var/lib/postgresql/data -w -t 60 -m fast"]
       - name: keycloak
-        image: harbor.internal.jpace121.net/k8s/jpace-keycloak:23.0.0
+        image: harbor.internal.jpace121.net/k8s/jpace-keycloak:26.8.0
         env:
         - name: KC_LOG_LEVEL
           value: DEBUG
@@ -57,20 +57,31 @@ spec:
             secretKeyRef:
               name: keycloak-secret
               key: KC_DB_PASSWORD
+        - name: KC_SPI_X509CERT_LOOKUP_PROVIDER
+          value: "nginx"
+        - name: KC_SPI_X509CERT_LOOKUP__NGINX__SSL_CLIENT_CERT
+          value: "ssl-client-cert"
+        - name: KC_SPI_TRUSTSTORE__FILE__PASSWORD
+          value: "password"
+        - name: KC_SPI_TRUSTSTORE__FILE__FILE
+          value: "/opt/keycloak-config/truststore.jks"
+        - name: KC_HTTPS_CLIENT_AUTH
+          value: "request"
+        - name: KC_HOSTNAME
+          value: "https://auth.jpace121.net"
+        - name: KC_HOSTNAME_ADMIN
+          value: "https://auth.jpace121.net"
+        - name: KC_HOSTNAME_STRICT
+          value: "true"
+        - name: KC_PROXY_HEADERS
+          value: "xforwarded"
+        - name: KC_HTTP_ENABLED
+          value: "true"
         volumeMounts:
         - name: keycloak-config
           mountPath: /opt/keycloak-config/
         args:
         - start
-        - --hostname-url=https://auth.jpace121.net
-        - --hostname-strict-backchannel=true
-        - --hostname-admin-url=https://auth.jpace121.net
-        - --https-client-auth=request
-        - --spi-truststore-file-file=/opt/keycloak-config/truststore.jks
-        - --spi-truststore-file-password=password
-        - --spi-x509cert-lookup-nginx-ssl-client-cert=ssl-client-cert
-        - --spi-x509cert-lookup-provider=nginx
-        - --proxy=edge
       volumes:
       - name: db-storage
         persistentVolumeClaim: